PT-2025-26179 · Ibm · Webmethods Integration Server

Filip Dragovic · Published 2025-06-18 · Updated 2025-08-13 · CVE-2025-36049

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM webMethods Integration Server versions 10.5, 10.7, 10.11, and 10.15

Description The issue is related to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this to execute arbitrary commands.

Recommendations For IBM webMethods Integration Server versions 10.5, 10.7, 10.11, and 10.15, consider disabling XML external entity processing until a patch is available. Restrict access to XML data processing modules to minimize the risk of exploitation. Avoid using vulnerable XML parsing functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-36049

Affected Products

Webmethods Integration Server

References · 9

• https://osv.dev/vulnerability/CVE-2025-36049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36049 · Security Note
• https://ibm.com/support/pages/node/7237146 · Vendor Advisory, Patch
• https://twitter.com/VulmonFeeds/status/1935404073869549609 · Twitter Post
• https://t.me/latest_high_impact_cve/2708 · Telegram Post
• https://twitter.com/cracbot/status/1937103412887425377 · Twitter Post
• https://t.me/cvetracker/26515 · Telegram Post
• https://t.me/cveNotify/132052 · Telegram Post
• https://twitter.com/CVEnew/status/1935723290234098052 · Twitter Post